Extracted

• • Target

    SecuriteInfo.com.Win64.PWSX-gen.5874.22719.exe

  • Size

    551KB

  • MD5

    599f3da4fcceeff012fb72ed22ba20f1

  • SHA1

    f93448764fccbf21b2f94711bf09310809298e43

  • SHA256

    630ea8ccea4f9f5667c356a897a037538288d57b4ca6464b3d90d17f3ba182d1

  • SHA512

    5384fd2d4d6f735c0e92d6ab64312dcf5d40497995fbdaf76433b9f149f998802bf751b12bbbcdde918ad9e7e87eff40c6d76fa0b443c96e1b710769b2df75e9

  • SSDEEP

    12288:JuN7XJPGa/5LplH5PN3r86eXEONa9iJ8jr4H:Juj+4zZO6Qnyn

  Score

  10^/10

  formbookurdepersistenceratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Sets service image path in registry

    persistence

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2